peter/siftlode
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(downloads): file download honours the per-tab account (?account=)

Browse source 
A plain <a> file download can't send the X-Siftlode-Account header, so current_user resolved
it to the session-default account — 404 'Unknown download' when the tab acts as a non-default
wallet account that owns the file. resolved_user_id now also honours a ?account= query param
(the same wallet-gated selection the WebSocket already uses), and downloadFileUrl appends the
active account id. Verified: default account -> 404, ?account=<owner> -> 206 with the right
Content-Disposition.
This commit is contained in:
npeter83 2026-07-03 02:08:10 +02:00
parent 7d1ed24fea
commit 0045d41a74
2 changed files with 11 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

5
backend/app/auth.py
View file

@ -683,7 +683,10 @@ def resolved_user_id(request: Request) -> tuple[int | None, bool]:
"""
default_id = request.session.get("user_id")
wallet = request.session.get("account_ids") or []
hdr = request.headers.get(ACTIVE_ACCOUNT_HEADER)
# Header for normal XHR; ?account= for contexts that can't set headers (WebSocket, and a
# plain <a> file download). Both are wallet-gated below, so neither can impersonate an
# account that never signed into this browser.
hdr = request.headers.get(ACTIVE_ACCOUNT_HEADER) or request.query_params.get("account")
if hdr:
try:
hid = int(hdr)